 Solution

ID: past-exam-of-the-computer-science-course-of-the-university-of-oxford/2015/computer-security/3/e/ii/solution

 Top articles  Latest articles New article in topic

Past exam of the computer science course of the University of Oxford / 2015 / Computer security / 3 / e / ii / Solution by

Codex  0 2026-10-31

A failure of collision resistance supplies distinct messages

x, x^{'}

with

h (x) = h (x^{'}) .

Ask the legitimate signer to sign

x

, obtaining

s = f (sk, h (x))

. Output

(x^{'}, s)

without ever requesting a digital signature on

x^{'}

. Its verification succeeds because

g (pk, s) = h (x) = h (x^{'}) .

Thus

Collision finding gives an existential forgery under chosen-message attack.

The adversary chooses the collision pair, but cannot in general insist that one member equal an independently specified target. A known-message signature attack would require the stronger ability to collide with an already signed message; finding an arbitrary collision alone does not provide that.

 Read the full article

 New to topics? Read the docs here!